First iPhone Worm Hits Australia with Pop Singer in Tow

The first known worm for Apple's iPhone is spreading on jail-broken iPhones in Australia. The worm takes advantage of the default password for SSH used by many jail-broken phones and places an image of 1980s pop singer Rick Astley on the device.

The first
known worm for the Apple iPhone is sweeping across Australia, and it is taking advantage of
default SSH passwords on jail-broken phones.
The attack
vector is the same as the one exploited by a Dutch teenager last week in a
brief extortion attempt. This time around, the mind behind the attack isn't
doing anything bad-unless you don't like having English pop singer Rick Astley as your wallpaper.

Once installed, the worm-known as ikee-tries to find other
iPhones on the mobile phone network that are vulnerable so it can propagate. On
each installation, the worm changes the lock background wallpaper to an image
of the 1980s singer with the message: -ikee is never going to give you up.'

"Ashley Towns, the author of the worm, says he
personally infected 100 jail-broken iPhones," said Graham Cluley, senior
technology consultant at Sophos. "Those iPhones would then have tried to infect
other jail-broken iPhones, and so on, and so on."
The
jail-broken iPhones impacted by the worm are running an SSH with the iPhone's
default password. Last week, news reports surfaced that a Dutch
attacker used the same situation in combination with port scanning and OS
fingerprinting to find iPhones in T-Mobile's 3G IP range to install backdoors
on the phones and scare users into paying ?Ã¶?Â®??5 (US$7.43) for instructions on how
to thwart the attack.
Security
vendor F-Secure reported that the latest attack scans a handful of IP ranges,
mostly in Australia. As of Sunday, the company
had no confirmed reports of the worm outside of Australia. The company noted that there are
four variants of the worm, and that Towns has provided full source code for the
malware. That means more variants could be forthcoming, and both Cluley and
F-Secure agreed the next payload could be worse.

"We can
only hold our breath and hope it doesn't happen," Cluley said. "Unfortunately
the genie is out of the bottle as the worm's code has been published on the Web.
It would be relatively trivial for malicious hackers to adapt the code to make
the worm more financially motivated rather than mischievous."